LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued… (CVE-2026-109353)

An SQL injection vulnerability exists in LibreNMS prior to version 26.9.0, specifically in the handling of the notification_id parameter in notifications.inc.php. Unprivileged users can supply an array-valued parameter to inject SQL commands, enabling cross-table reads of sensitive data such as users.password hashes. The injected query results are persisted in the notifications_attribs table and can be viewed through the LibreNMS interface, potentially exposing password hashes to unauthorized users.

Successful exploitation allows an attacker with limited privileges to read password hashes from the users table by injecting SQL commands. This compromises the confidentiality of user credentials and could facilitate further attacks if password hashes are cracked. The vulnerability does not appear to allow modification or deletion of data (integrity impact is low), nor does it affect availability.

A fix is available in LibreNMS version 26.9.0. Users should upgrade to version 26.9.0 or later to remediate this vulnerability. No vendor advisory or patch links were provided, so verify the upgrade path with official LibreNMS sources before applying.